@portll/cobolwork 0.2.140 → 0.2.150

package/README.md

@@ -187,6 +187,11 @@ since a test that missed the route does not show it safe.
 `summary.handling`, because it is then a list of what to attack first. Upload it only where the RACF
 facts behind it may go. [docs/spec/reach.md](docs/spec/reach.md) §9 is the full specification.
 
+`COBOLWORK_EXECUTION` names reports `ironwork run --coverage` wrote from runs of the estate's own
+tests. A finding inside a paragraph they cover carries `executed`, the paragraph and how often the
+runs entered it, and `summary.byExecution` counts the findings in paragraphs entered and never
+entered ([docs/spec/evidence.md](docs/spec/evidence.md) §13.5).
+
 ### What each finding lets someone do, and the fix
 
 A defect finding carries two more facts, the same for every finding of its rule: what someone can do
@@ -339,13 +344,20 @@ the guard off, it just stops the host's load from deciding. A spawned scan inher
 
 ## Compliance
 
-Every rule is mapped to the clause of each framework that makes it an obligation, quoted verbatim:
+Every rule is mapped to the clause of each framework that makes it an obligation, quoted verbatim,
+and to a COBIT 2019 practice by identifier alone:
 
 | File | Instrument | Rules mapped |
 |---|---|---|
 | `rules/compliance-dora.json` | Regulation (EU) 2022/2554 (DORA) | 203 |
 | `rules/compliance-ffiec.json` | FFIEC IT Examination Handbook | 201, and 2 recorded as unmapped |
 | `rules/compliance-nist80053.json` | NIST SP 800-53 Rev. 5.2.0 | 201, and 2 recorded as unmapped |
+| `rules/compliance-cobit2019.json` | COBIT 2019 (ISACA), identifiers only | 201, and 2 recorded as unmapped |
+
+A COBIT 2019 row names the objective or practice and gives this project's own rationale; no ISACA
+text is reproduced, so reading what a practice says needs a copy of the framework. The practice is
+chosen at the NIST control, through a crosswalk in `diag/map-compliance.mjs`, so it cannot drift
+from the rule's NIST clause.
 
 `node diag/map-compliance.mjs` refuses to write a quote the cached instrument does not contain, and
 every scan carries the mapping as `ruleCompliance`. The clause choice is a judgement that no

package/THIRD-PARTY-NOTICES.md

@@ -89,8 +89,9 @@ its source URL and retrieval date:
 - **NIST SP 800-53 Rev. 5** — a work of the US Government.
 - **FFIEC IT Examination Handbook** — a work of the US Government.
 
-PCI DSS and the COBIT-derived SOX material are deliberately absent: they may not be redistributed,
-so they belong in a licensed feed rather than in this repository. Full instrument texts are never
+COBIT 2019 appears as objective and practice identifiers only, with this project's own rationale;
+no text of COBIT, which is ISACA's, is reproduced. PCI DSS is deliberately absent: it may not be
+redistributed. Full instrument texts are never
 committed (`feed/sources/` is ignored); the feed ships citations, not text.
 
 ## Vulnerability data

package/bin/cobolwork.mjs

@@ -16,6 +16,8 @@ import { build, buildSarif, buildSummaryLine } from '../lib/build.mjs';
 import { capabilities } from '../lib/capabilities.mjs';
 import { commitAt, revisionOf, toolRevision } from '../lib/revision.mjs';
 import { stampFingerprints } from '../lib/kernel/identity.mjs';
+import { pdsExportTree } from '../lib/kernel/source-tree.mjs';
+import { SITE_FILE } from '../lib/site.mjs';
 import { tally } from '../lib/kernel/findings.mjs';
 import { loadBaseline, applyBaseline, baselineEntries, BASELINE_FILE, SUPPRESSING } from '../lib/baseline.mjs';
 import { readReport } from '../lib/tui/model.mjs';
@@ -86,6 +88,9 @@ Options
                         baseline: the judgement each new entry records, and which rules it covers
   --advisories <file>[,<file>]  a customer's own advisory extract (JSON), loaded for this scan only;
                         never kept in the tree
+  --pds-export          scan: the directory holds partitioned data sets' members as files, as
+                        zowe zos-files download all-members writes them (hlq/llq/member.txt) or in a
+                        directory named for each data set; findings name DATA.SET/MEMBER
   --copylib <dir>[,<dir>]  copy libraries the estate keeps outside the repository, searched after the
                         tree's own copybooks, as COBCPY is; a copybook found there is read, not reported missing
   --report <file>       tui, explain: read a stored scan report instead of scanning
@@ -150,6 +155,7 @@ function parseArgs(argv) {
     else if (a === '--action') opts.action = value();
     else if (a === '--rule') opts.rule = list();
     else if (a === '--advisories') opts.advisoryFeeds = [...new Set(list().map(x => resolve(x)))];
+    else if (a === '--pds-export') opts.pdsExport = true;
     else if (a === '--copylib') opts.copylib = [...new Set(list().map(x => resolve(x)))];
     else if (a === '--report') opts.report = value();
     else if (a === '--keys') opts.keys = value();
@@ -198,6 +204,7 @@ function warnCoverage(report) {
 }
 
 const isLink = (p) => { try { return lstatSync(p).isSymbolicLink(); } catch { return false; } };
+const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
 
 let journal = null;
 
@@ -262,6 +269,8 @@ if (opts.copylib && opts._.length && !COPYLIB_COMMANDS.includes(opts._[0])) {
 const notDirs = (opts.copylib || []).filter((d) => { try { return !statSync(d).isDirectory(); } catch { return true; } });
 if (notDirs.length) { process.stderr.write(`cobolwork: --copylib ${notDirs.join(', ')} is not a directory\n`); process.exit(2); }
 const systemDirs = opts.copylib || [];
+if (opts.pdsExport && opts._.length && opts._[0] !== 'scan') { process.stderr.write('cobolwork: --pds-export is for scan only\n'); process.exit(2); }
+if (opts.pdsExport && opts.repos) { process.stderr.write('cobolwork: --pds-export reads one export; --repos does not apply\n'); process.exit(2); }
 if (opts.json && opts._.length && opts._[0] !== 'capabilities') {
   process.stderr.write(`cobolwork: --json is for capabilities; every other command writes JSON unless --format says otherwise\n`);
   process.exit(2);
@@ -332,7 +341,13 @@ try {
     process.exitCode = evidenceCommand(target, opts, { toolVersion: VERSION, write: (s) => process.stdout.write(s) });
   } else if (command === 'scan' || command === 'flow') {
     const flowOpts = { repos, fullTrace: opts.fullTrace === true, systemDirs };
-    const report = command === 'flow' ? scanFlow(root, flowOpts) : scanAll(root, { ...flowOpts, only: opts.only, advisoryFeeds: opts.advisoryFeeds });
+    // The site file sits beside the members and is not one of them, so it is named rather than found.
+    const site = resolve(root, SITE_FILE);
+    const pds = opts.pdsExport ? pdsExportTree(root, { systemDirs }) : null;
+    const report = command === 'flow' ? scanFlow(root, flowOpts)
+      : pds ? scanAll(pds.root, { ...flowOpts, only: opts.only, advisoryFeeds: opts.advisoryFeeds, tree: pds, feedRoot: root, site: isFile(site) && !isLink(site) ? site : null })
+      : scanAll(root, { ...flowOpts, only: opts.only, advisoryFeeds: opts.advisoryFeeds });
+    if (pds) report.summary.pdsExport = pds.export;
     if (command === 'flow') {
       report.summary.identity = stampFingerprints(report.findings, { root });
       stampFingerprints(report.checked, { root });

package/lib/baseline.mjs

@@ -16,7 +16,7 @@
 // because the finding it would hide is evidence that the tree is not to be trusted. A baseline
 // passed from outside the tree can.
 import { readFileSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { tally } from './kernel/findings.mjs';
 import { resolvesInside } from './kernel/source-tree.mjs';
 import { printable } from './kernel/printable.mjs';
@@ -54,22 +54,24 @@ export function validateEntry(e) {
 
 // { path, source, entries, problems }. An absent file is an empty baseline, not an error; an
 // unreadable one is a problem the report carries, never a silent empty.
-export function loadBaseline(root, { explicit = null, use = true, mayBeAbsent = false } = {}) {
+// A source tree held in memory (a git revision) supplies its own baseline file.
+export function loadBaseline(root, { explicit = null, use = true, mayBeAbsent = false, tree = null } = {}) {
   if (!use) return null;
-  const path = explicit || join(root, BASELINE_FILE);
-  if (!existsSync(path)) {
+  const held = !explicit && tree && tree.kind !== 'directory';
+  const path = explicit || (held ? resolve(tree.root, BASELINE_FILE) : join(root, BASELINE_FILE));
+  if (held ? !tree.contains(path) : !existsSync(path)) {
     if (!explicit) return null;
     if (mayBeAbsent) return { path, source: 'explicit', entries: [], problems: [] };
     return { path, source: 'explicit', entries: [], problems: [`${path} does not exist, so nothing was suppressed`] };
   }
   const out = { path, source: explicit ? 'explicit' : 'tree', entries: [], problems: [] };
   // The tree's own baseline is the tree's, and a link out of it is not followed.
-  if (!explicit && !resolvesInside(root, path)) {
+  if (!explicit && !held && !resolvesInside(root, path)) {
     out.problems.push(`${BASELINE_FILE} is a link that leads outside the tree, so nothing was suppressed`);
     return out;
   }
   let raw;
-  try { raw = JSON.parse(readFileSync(path, 'utf8')); } catch (err) {
+  try { raw = JSON.parse(held ? tree.bytes(path).toString('utf8') : readFileSync(path, 'utf8')); } catch (err) {
     out.problems.push(`${path} is not readable as JSON: ${printable(err.message, 120)}`);
     return out;
   }

package/lib/bms.mjs

@@ -15,7 +15,7 @@
 //
 // This reads text and opens nothing; the caller reads the file through the source tree, so
 // containment stays where it is enforced.
-import { parseOperands, splitOperands } from './jcl.mjs';
+import { parseOperands, splitOperands } from './cards.mjs';
 
 // Column 72 marks a continuation and 73 to 80 are the sequence field, so a statement ends at 71.
 const END_COLUMN = 71;

package/lib/capabilities.mjs

@@ -17,7 +17,7 @@ export const CAPABILITIES_SCHEMA_VERSION = 1;
 
 // Each command, what it takes and what it writes.
 export const COMMANDS = {
-  scan: { args: ['<path>'], options: ['--format', '--out', '--repos', '--only', '--quiet', '--full-trace', '--baseline', '--no-baseline', '--advisories', '--copylib', '--evidence'], documents: ['cobolwork', 'sarif'] },
+  scan: { args: ['<path>'], options: ['--format', '--out', '--repos', '--only', '--quiet', '--full-trace', '--baseline', '--no-baseline', '--advisories', '--copylib', '--pds-export', '--evidence'], documents: ['cobolwork', 'sarif'] },
   flow: { args: ['<path>'], options: ['--out', '--repos', '--quiet', '--full-trace', '--baseline', '--no-baseline', '--copylib', '--evidence'], documents: ['cobolwork-flow'] },
   inventory: { args: ['<path>'], options: ['--out', '--quiet', '--copylib', '--evidence'], documents: ['cobolwork-inventory'] },
   parse: { args: ['<file>'], options: ['--out'], documents: ['cobolwork-parse'] },
@@ -68,6 +68,7 @@ export function capabilities() {
       jcl: JCL_EXT,
       bms: BMS_EXT,
       extensionless: 'sniffed by content: a file with no extension is classified by what it holds',
+      pdsExport: 'scan --pds-export: every member classified by content, whatever extension the download gave it; text, --binary and --record downloads',
       zowe: ['zowe.config.json', 'zowe.config.user.json', '.mcp.json', '.vscode/mcp.json', '.cursor/mcp.json', '.claude/settings.json', '.claude/settings.local.json', '.gemini/settings.json', 'claude_desktop_config.json', '.vscode/settings.json', 'systems.json under a mock directory'],
     },
     evidenceKinds: Object.keys(EVIDENCE),

package/lib/cards.mjs

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Card-image source: where a line's fields sit on the card, and how an operand field splits. COBOL
+// in fixed or variable reference format has a sequence area (columns 1-6), an indicator (7), program
+// text (8-72, or 8-250 in variable format) and what follows, which the compiler ignores. A JCL or
+// utility control statement is columns 1-72, with its sequence number after. Free-format COBOL is
+// text from end to end.
+
+export const TEXT_END = { fixed: 72, variable: 250 };
+export const STATEMENT_END = 72;
+
+export function cobolCard(line, format) {
+  const end = TEXT_END[format];
+  if (!end) return { sequence: '', indicator: '', text: line, ignored: '' };
+  return { sequence: line.slice(0, 6), indicator: line[6] || ' ', text: line.slice(7, end), ignored: line.slice(end) };
+}
+
+export function statementCard(line) {
+  return { text: line.slice(0, STATEMENT_END), sequence: line.slice(STATEMENT_END) };
+}
+
+// Splits an operand field on commas that are not inside parentheses or quotes. JCL, BMS and HLASM nest
+// both, and a naive split on comma turns DISP=(NEW,CATLG,DELETE) into three operands.
+export function splitOperands(s) {
+  const out = [];
+  let depth = 0, quoted = false, start = 0;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (quoted) { if (c === "'") { if (s[i + 1] === "'") i++; else quoted = false; } continue; }
+    if (c === "'") quoted = true;
+    else if (c === '(') depth++;
+    else if (c === ')') depth = Math.max(0, depth - 1);
+    else if (c === ',' && depth === 0) { out.push(s.slice(start, i)); start = i + 1; }
+  }
+  out.push(s.slice(start));
+  return out.filter((x, i, a) => x.length || i < a.length - 1);
+}
+
+// Operands are positional until the first KEY=VALUE, and keyword after it: JCL's EXEC takes its
+// procedure name positionally, and everything interesting on a DD is a keyword.
+export function parseOperands(field) {
+  const positional = [];
+  const keywords = new Map();
+  for (const raw of splitOperands(field)) {
+    const part = raw.trim();
+    if (!part) continue;
+    const eq = keywordSplit(part);
+    if (eq < 0) positional.push(part);
+    else keywords.set(part.slice(0, eq).toUpperCase(), part.slice(eq + 1));
+  }
+  return { positional, keywords };
+}
+
+// The first '=' that is not inside parentheses or quotes. DCB=(RECFM=FB,LRECL=80) is one keyword
+// whose value happens to contain more of them.
+function keywordSplit(part) {
+  let depth = 0, quoted = false;
+  for (let i = 0; i < part.length; i++) {
+    const c = part[i];
+    if (quoted) { if (c === "'") { if (part[i + 1] === "'") i++; else quoted = false; } continue; }
+    if (c === "'") quoted = true;
+    else if (c === '(') depth++;
+    else if (c === ')') depth = Math.max(0, depth - 1);
+    else if (c === '=' && depth === 0) return i;
+  }
+  return -1;
+}

package/lib/compliance.mjs

@@ -5,10 +5,10 @@
 // against each. The difference between them is this file, and it is the difference between a
 // tooling budget and a compliance budget.
 //
-// DORA, NIST SP 800-53 and the FFIEC IT Examination Handbook ship here because their instruments
-// may be reproduced: one is EU law, the other two US Government works. PCI DSS and the COBIT-derived SOX material may not be
-// redistributed, so those mappings belong in the licensed feed rather than in an AGPL repository.
-// The split is a licensing fact before it is a product decision.
+// DORA, NIST SP 800-53 and the FFIEC IT Examination Handbook ship with quotes because their
+// instruments may be reproduced: one is EU law, the other two US Government works. COBIT 2019 ships
+// as identifiers with this project's own rationale and no ISACA text. PCI DSS may not be
+// redistributed and is not mapped.
 //
 // A framework may decline to cover a rule. Neither NIST nor FFIEC has a control that genuinely
 // covers committing an LPAR name to a repository, and that is recorded as an unmapped rule with a
@@ -19,6 +19,7 @@ const FRAMEWORKS = [
   { id: 'dora', file: '../rules/compliance-dora.json' },
   { id: 'nist-800-53r5', file: '../rules/compliance-nist80053.json' },
   { id: 'ffiec', file: '../rules/compliance-ffiec.json' },
+  { id: 'cobit-2019', file: '../rules/compliance-cobit2019.json' },
 ];
 
 // A framework that will not parse is a framework this scan cannot map against, which is the same
@@ -64,7 +65,7 @@ const byRule = new Map();
 for (const d of loaded) {
   for (const r of d.rows) {
     if (!byRule.has(r.ruleId)) byRule.set(r.ruleId, []);
-    byRule.get(r.ruleId).push({ framework: r.framework, clause: r.clause, title: r.title });
+    byRule.get(r.ruleId).push({ framework: r.framework, clause: r.clause, ...(r.title ? { title: r.title } : {}) });
   }
 }
 

package/lib/control.mjs

@@ -251,6 +251,12 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
   const loopBody = new Map();
   const stmtAt = new Map();
   for (const st of prog.statements) if (st.at != null && st.verb !== 'WHEN') stmtAt.set(st.at, st);
+  const unpassedBy = new Map();
+  for (const c of prog.calls || []) {
+    const st = prog.statements[c.stmtIndex];
+    if (st) unpassedBy.set(st, new Set([c.targetTok, ...c.using.filter((a) => a.mode !== 'REFERENCE' && a.tok).map((a) => a.tok)]));
+  }
+  const external = (it) => { for (let a = it; a; a = a.parent) if (a.external) return true; return false; };
   const labelAt = new Map();
   for (const l of prog.labels) if (l.at != null) labelAt.set(l.at, l);
   const labelNames = new Set(prog.labels.map((l) => l.name));
@@ -640,11 +646,14 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
       for (const t of n.st.targets || []) add(t);
       if (n.st.verb === 'CALL' || n.st.verb === 'READ' || n.st.verb === 'RETURN') {
         // A callee may write what it is passed by reference, and a READ fills the file's records.
+        // The field naming the program called, and what goes BY CONTENT or BY VALUE, is not passed
+        // for the callee to write - unless it is EXTERNAL, which any program can.
+        const unpassed = n.st.verb === 'CALL' ? unpassedBy.get(n.st) : null;
         for (const t of n.st.sources || []) {
           const f = resolve(t);
           if (!f) continue;
           if (f.records) for (const r of f.records) out.push(r);
-          else if (n.st.verb === 'CALL') out.push(f);
+          else if (n.st.verb === 'CALL' && !(unpassed && unpassed.has(t) && !external(f))) out.push(f);
         }
       }
     }
@@ -1083,7 +1092,10 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
       const bounds = { lo: 1, hi };
       const c = { id: checks.length, key, field, file: list[0].n.st.file, line: list[0].n.st.line, tCons: { numeric: true, lo: 1, loInc: true, hi, hiInc: true }, fCons: null, restricts: false, assigned: true, bounds };
       checks.push(c);
-      for (const a of list) if (Number(a.value) <= hi) (a.upTo ||= []).push(c);
+      // "At most v" alone, which a decrement that cannot go below 0 leaves standing.
+      const top = { id: checks.length, key, field, file: c.file, line: c.line, tCons: { numeric: true, hi, hiInc: true }, fCons: null, restricts: false, assigned: true, bounds: { hi } };
+      checks.push(top);
+      for (const a of list) if (Number(a.value) <= hi) (a.upTo ||= []).push(c, top);
     }
   }
   // Fact numbers: for each check, `x` that it ran (only a restricting one), `t` and `f` that it came
@@ -1419,6 +1431,40 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     (a.n.genStmt ||= []).push(newLo(a.field, v, a.n.st).t);
   }
   // An increment by at least m turns "at least k" into "at least k + m", where the sum fits the field.
+  // The fields a statement only ever lowers, by a constant, and by how much at most.
+  const decrements = (st) => {
+    const seg = segOf(st);
+    let fields = [];
+    let max = 0;
+    const amount = (t) => { const v = t && (t.t === 'word' || t.t === 'num') ? numberOf(constValue([t])) : null; return v != null && Number.isInteger(v) && v >= 0 ? v : null; };
+    if (st.verb === 'SUBTRACT') {
+      const from = seg.findIndex((t) => WORD(t, 'FROM'));
+      if (from < 1 || seg.some((t) => WORD(t, 'GIVING') || WORD(t, 'CORRESPONDING') || WORD(t, 'CORR'))) return null;
+      for (const t of seg.slice(0, from)) { const v = amount(t); if (v == null) return null; max += v; }
+      const end = seg.findIndex((t, i) => i > from && PHRASE_AT(t));
+      if (seg.slice(from + 1, end < 0 ? seg.length : end).some((t) => t.t === 'sep')) return null;
+      fields = (st.targets || []).map((t) => resolve(t));
+    } else if (st.verb === 'SET') {
+      const down = seg.findIndex((t) => WORD(t, 'DOWN'));
+      if (down < 1 || !WORD(seg[down + 1], 'BY') || seg.length !== down + 3 || seg.slice(0, down).some((t) => t.t !== 'word')) return null;
+      max = amount(seg[down + 2]);
+      if (max == null) return null;
+      fields = (st.targets || []).map((t) => resolve(t));
+    } else if (st.verb === 'COMPUTE') {
+      const eq = seg.findIndex((t) => t.t === 'op' && t.v === '=');
+      const lhs = seg.slice(0, eq).filter((t) => !WORD(t, 'ROUNDED'));
+      const end = seg.findIndex((t, i) => i > eq && PHRASE_AT(t));
+      const rhs = seg.slice(eq + 1, end < 0 ? seg.length : end);
+      if (eq < 1 || lhs.length !== 1 || lhs[0].t !== 'word' || rhs.length !== 3 || rhs[1].t !== 'op' || rhs[1].v !== '-') return null;
+      const target = resolve(lhs[0]);
+      if (rhs[0].t !== 'word' || resolve(rhs[0]) !== target) return null;
+      max = amount(rhs[2]);
+      if (max == null) return null;
+      fields = [target];
+    } else return null;
+    fields = [...new Set(fields.filter((f) => intCap(f) != null))];
+    return fields.length ? { fields, max } : null;
+  };
   const lifted = new Map();
   for (const [id, inc] of raisers) {
     const list = [];
@@ -1712,7 +1758,7 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     const r = rangeOfField(leaf.f);
     const base = { needs: [], lo: r.hold.lo, hi: r.hold.hi };
     if (!leaf.plain) return [base];
-    const cv = numberOf(constValue([leaf.tok]));
+    const cv = leaf.tok ? numberOf(constValue([leaf.tok])) : null;
     if (cv != null && Number.isInteger(cv)) return [{ needs: [], lo: BigInt(cv), hi: BigInt(cv) }];
     if (!heldBits) return [base];
     let lo = null;
@@ -1781,9 +1827,19 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     }
     return out;
   };
+  // The derived intervals that hold every whole number from lo to hi, an open end holding nothing.
+  const containing = (key, lo, hi) => {
+    const out = [];
+    for (const c of factsByKey.get(key) || []) {
+      if (!c.derived) continue;
+      const e = wholeEnds(c.tCons);
+      if (e && (e.lo == null || (lo != null && e.lo <= lo)) && (e.hi == null || (hi != null && e.hi >= hi))) out.push(c.t);
+    }
+    return out;
+  };
   const expandRules = () => {
     indexFacts();
-    for (const n of nodes) { n.derive = undefined; n.genArith = undefined; }
+    for (const n of nodes) { n.derive = undefined; n.genArith = undefined; n.genArithOn = undefined; }
     for (const r of rules) {
       const bits = withLooser(r.fact);
       const at = r.bucket == null ? r.n : nodes[r.n.test];
@@ -1792,6 +1848,26 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
         else ((at.genArithOn ||= { true: [], false: [] })[r.bucket]).push(...bits);
       } else (r.n.derive ||= []).push({ needs: r.needs, to: bits });
     }
+    // A constant moved, and a check's outcome, are values too: routes that reached an interval by
+    // arithmetic and routes that reached it by a move or a test meet at it.
+    for (const a of assigns) {
+      const v = numberOf(a.value);
+      if (v == null || !Number.isInteger(v)) continue;
+      const bits = containing(fieldKey(a.field), BigInt(v), BigInt(v));
+      if (bits.length) (a.n.genArith ||= []).push(...bits);
+    }
+    for (const id of tests) {
+      const n = nodes[id];
+      for (const c of n.checks || []) {
+        for (const [cons, bucket] of [[c.tCons, 'true'], [c.fCons, 'false']]) {
+          if (!cons || (cons.set && cons.set.size)) continue;
+          const e = wholeEnds(cons);
+          if (!e || (e.lo == null && e.hi == null)) continue;
+          const bits = containing(c.key, e.lo, e.hi);
+          if (bits.length) ((n.genArithOn ||= { true: [], false: [] })[bucket]).push(...bits);
+        }
+      }
+    }
   };
 
   const ARITH_VERBS = new Set(['COMPUTE', 'ADD', 'SUBTRACT', 'MULTIPLY', 'DIVIDE', 'MOVE']);
@@ -1985,6 +2061,8 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     const before = relevant.size;
     for (const a of arith) if (a.targets.some((r) => r.f && relevant.has(r.f))) for (const tree of a.trees) for (const l of tree ? leaves(tree) : []) relevant.add(l.f);
     for (const r of relations.values()) if (relevant.has(r.f) || relevant.has(r.g)) { relevant.add(r.f); relevant.add(r.g); }
+    // A loop condition that bounds a relevant counter through another field makes that field relevant.
+    for (const c of checks) { if (c.pseudo || !c.field || !relevant.has(c.field)) continue; for (const d of [c.tDep, c.fDep]) if (d?.g) relevant.add(d.g); }
     more = relevant.size > before;
   }
 
@@ -1996,6 +2074,20 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     let grew = false;
     try {
     indexFacts();
+    // A check's outcome as an interval of its own, which arithmetic's intervals can widen into at a join.
+    for (const id of tests) {
+      for (const c of nodes[id].checks || []) {
+        if (!relevant.has(c.field) || !rangeOfField(c.field) || inTable(c.field)) continue;
+        for (const cons of [c.tCons, c.fCons]) {
+          if (!cons || (cons.set && cons.set.size)) continue;
+          const e = wholeEnds(cons);
+          if (!e || (e.lo == null && e.hi == null)) continue;
+          const had = derivedOf.get(c.field)?.size || 0;
+          derivedFact(c.field, e.lo, e.hi, nodes[id].at || nodes[id].st);
+          if ((derivedOf.get(c.field)?.size || 0) > had) grew = true;
+        }
+      }
+    }
     for (const a of arith) {
       a.trees.forEach((tree, i) => {
         const r = a.targets[i];
@@ -2032,6 +2124,27 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
         }
       }
     }
+    // A bound over an expression in one other field, X <= G - 1, takes the interval G holds at the test.
+    for (const c of checks) {
+      if (c.pseudo || c.test == null || !relevant.has(c.field) || !rangeOfField(c.field) || inTable(c.field)) continue;
+      for (const o of [true, false]) {
+        const dep = o ? c.tDep : c.fDep;
+        const at = dep && outcomeAt.get(`${c.test}|${o}`);
+        if (!at || !rangeOfField(dep.g) || inTable(dep.g) || !Number.isInteger(dep.m) || !Number.isInteger(dep.b)) continue;
+        const hold = rangeOfField(c.field).hold;
+        heldBits = prev ? prev.get(c.test) || null : null;
+        for (const cand of leafCands({ f: dep.g, tok: null, plain: true })) {
+          const v = BigInt(dep.m) * (dep.needs === 'hi' ? cand.hi : cand.lo) + BigInt(dep.b);
+          let lo = null, hi = null;
+          if (dep.side === 'hi') hi = dep.inc ? v : v - 1n; else lo = dep.inc ? v : v + 1n;
+          if (lo != null && lo <= hold.lo) lo = null;
+          if (hi != null && hi >= hold.hi) hi = null;
+          if ((lo == null && hi == null) || (hi != null && hi < hold.lo) || (lo != null && lo > hold.hi)) continue;
+          const fact = derivedFact(c.field, lo, hi, at.st || nodes[c.test].at || nodes[c.test].st);
+          if (fact && derive(at, cand.needs, fact, String(o))) grew = true;
+        }
+      }
+    }
     // A relation holds after the outcome of its test that makes it true, and the fields it bounds hold
     // what the other side could hold.
     for (const id of tests) {
@@ -2161,6 +2274,31 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
     } else if (n.kind === 'step' && stepped.has(id)) {
       keepAcross(n, [{ ...stepped.get(id), sizeError: false }]);
     }
+    // An upper bound survives a decrement that cannot go below 0: one where the field was at least the
+    // amount before it, so nothing is stored as an absolute value or wraps.
+    if (n.kind === 'stmt' && n.st && n.st.at != null) {
+      const dec = decrements(n.st);
+      const wrote = dec ? writtenBy(n) : [];
+      for (const field of dec ? dec.fields : []) {
+        if (wrote.some((w) => w !== field && overlaps(w, field))) continue;
+        const key = fieldKey(field);
+        const keep = [];
+        const guards = [];
+        for (const c of checks) {
+          if (c.key !== key || c.pseudo) continue;
+          for (const [bit, cons] of [[c.t, c.tCons], [c.f, c.fCons]]) {
+            if (bit == null || !cons || cons.dep || (cons.set && cons.set.size)) continue;
+            const r = asRange(cons);
+            if (r.hi != null && r.lo == null) keep.push(bit);
+            if (r.lo != null && (r.loInc ? r.lo : Math.floor(r.lo) + 1) >= dec.max) guards.push(bit);
+          }
+        }
+        if (!keep.length || !guards.length) continue;
+        const bits = new Uint32Array(words);
+        for (const b of keep) bits[b >>> 5] |= 1 << (b & 31);
+        (n.keeps ||= []).push({ bits, guards });
+      }
+    }
     if (n.kind === 'step' && keptOnStep.has(id)) {
       const bits = new Uint32Array(words);
       for (const b of keptOnStep.get(id)) bits[b >>> 5] |= 1 << (b & 31);
@@ -2440,6 +2578,39 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
   const posOf = new Map();
   const places = [];
   let placeFacts = nFacts;
+  // The tightest end of a field's value the facts `bits` hold, or its picture's.
+  const boundAt = (g, needs, bits) => {
+    const hold = rangeOfField(g)?.hold;
+    let best = hold ? Number(needs === 'hi' ? hold.hi : hold.lo) : null;
+    if (best != null && !Number.isFinite(best)) best = null;
+    for (const c of checks) {
+      if (c.pseudo || c.key !== fieldKey(g)) continue;
+      for (const [bit, cons] of [[c.t, c.tCons], [c.f, c.fCons]]) {
+        if (!cons || !hasFact(bits, bit)) continue;
+        const e = wholeEnds(cons);
+        const v = e && (needs === 'hi' ? e.hi : e.lo);
+        if (v == null) continue;
+        const n = Number(v);
+        if (best == null || (needs === 'hi' ? n < best : n > best)) best = n;
+      }
+    }
+    return best;
+  };
+  // A relation over an expression, X <= G - 1, read with what G held at the test.
+  const resolveDeps = (map, bits) => {
+    const out = new Map();
+    for (const [key, c] of map) {
+      const dep = c && c.dep;
+      const g = dep ? boundAt(dep.g, dep.needs, bits) : null;
+      if (g == null || !Number.isInteger(dep.m) || !Number.isInteger(dep.b)) { out.set(key, c); continue; }
+      const v = dep.m * g + dep.b;
+      const plain = plainCons(c) || {};
+      const had = plain[dep.side];
+      const tighter = had == null || (dep.side === 'hi' ? v < had : v > had);
+      out.set(key, tighter ? { ...plain, [dep.side]: v, [`${dep.side}Inc`]: dep.inc } : plain);
+    }
+    return out;
+  };
   for (const id of tests) {
     const n = nodes[id];
     if (!n.st || !n.st.indexes || !n.tree || n.evaluate || !(n.st.verb === 'IF' || n.loop)) continue;
@@ -2454,7 +2625,8 @@ export function buildControl(prog, resolve, { extra = null } = {}) {
       for (const g of guards || []) {
         let cons = new Map();
         const r = new Map();
-        for (const [sub, outcome] of g) { cons = meetMaps(cons, consOf(sub, outcome)); testedWhen(sub, outcome, r); }
+        const atTest = facts.get(id);
+        for (const [sub, outcome] of g) { cons = meetMaps(cons, atTest ? resolveDeps(consOf(sub, outcome), atTest) : consOf(sub, outcome)); testedWhen(sub, outcome, r); }
         said = said ? joinMaps(said, cons) : cons;
         ran = ran ? new Map([...ran].filter(([k]) => r.has(k))) : r;
       }

package/lib/dataflow.mjs

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
-import { inScope, isProgram, isBms, readSource, relPath } from './sources.mjs';
+import { inScope, isProgram, isBms, relPath } from './sources.mjs';
 import { parseBms, symbolicNames } from './bms.mjs';
 import { dirname, join } from 'node:path';
 import { parseSource, buildFileIndex } from './parser.mjs';
@@ -197,6 +197,7 @@ export function analyze(root, opts = {}) {
   const nodes = [];
   const programs = [];
   const jclPending = [];
+  const jclTrees = new Map();
   // CICS definitions, from CSD extracts and from DFHCSDUP job input, and the estate's own statement
   // of which DDs and queues reach the internal reader.
   const csd = { tdqueues: new Map(), transactions: new Map(), urimaps: new Map() };
@@ -209,7 +210,7 @@ export function analyze(root, opts = {}) {
   const jobSteps = [];
   // The maps of the repository being read, by MAPSET/MAP and by MAP alone.
   const bmsMaps = new Map();
-  const site = loadSite(root, opts.site || null);
+  const site = loadSite(root, opts.site || null, opts.tree);
   const relOf = new Map();
   const rel = (p) => { let r = relOf.get(p); if (r === undefined) { r = relPath(root, p); relOf.set(p, r); } return r; };
   // `at` is the statement an edge that is not a statement's own is read at: the CALL or LINK that
@@ -959,7 +960,7 @@ export function analyze(root, opts = {}) {
     const tree = (!repo && opts.tree) ? opts.tree : directoryTree(base, opts);
     const idx = tree.index;
     const files = tree.list().filter(isProgram).filter(inScope(opts));
-    for (const f of tree.list().filter(isJcl).filter(inScope(opts))) jclPending.push(f);
+    for (const f of tree.list().filter(isJcl).filter(inScope(opts))) { jclPending.push(f); jclTrees.set(f, tree); }
     for (const f of tree.list().filter((p) => /\.csd$/i.test(p)).filter(inScope(opts))) {
       try { addCsd(tree.text(f).text, f); } catch (e) { stats.unreadable++; unread.push(`${tree.rel(f)}: ${e.code || e.name}`); }
     }
@@ -1088,7 +1089,7 @@ export function analyze(root, opts = {}) {
   // ACCEPT FROM COMMAND-LINE is untrusted.
   for (const f of jclPending) {
     let src;
-    try { src = readSource(f).text; } catch (e) { stats.unreadable++; unread.push(`${rel(f)}: ${e.code || e.name}`); continue; }
+    try { src = jclTrees.get(f).text(f).text; } catch (e) { stats.unreadable++; unread.push(`${rel(f)}: ${e.code || e.name}`); continue; }
     let job;
     try { job = parseJcl(src, f); } catch (e) { stats.threw++; unparsed.push(`${rel(f)}: ${e.code || e.name}`); continue; }
     stats.jclFiles++;